* [[Chaosreader]] is a session reconstruction tool (supports both live or captured network traffic)

+

* [[Kismet]]

+

* [[logstash]] is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. [http://logstash.net/]

+

+

* [[log2Timeline]] a framework for automatic creation of a super timeline. The main purpose is to provide a single tool to parse various log files and artifacts found on suspect systems (and supporting systems, such as network equipment) and produce a timeline that can be analysed by forensic investigators/analysts. [https://code.google.com/p/log2timeline/]

* [[NetFSE]] is a web-based search and analysis application for high-volume network data [http://www.netfse.org available at NetFSE.org]

* [[NetFSE]] is a web-based search and analysis application for high-volume network data [http://www.netfse.org available at NetFSE.org]

* [http://www.netgrab.co.uk NetSleuth] is a live and retrospective network analysis and triage tool.

* [http://www.netgrab.co.uk NetSleuth] is a live and retrospective network analysis and triage tool.

+

* [[ntop]]

+

* [[NetGREP]] is a command line tool which tells you which lines in a text file contain network resources related to a particular country or Autonomous Network (AS) [https://pypi.python.org/pypi/netgrep/]

+

* [[NetworkMiner]] is [http://sourceforge.net/apps/mediawiki/networkminer/index.php?title=NetworkMiner an open source Network Forensics Tool available at SourceForge]

+

* [[OSSEC]]

+

* [[Plaso]] (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines [http://plaso.kiddaland.net/]

+

+

* [[RegRipper]] is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis [http://regripper.wordpress.com/]

Revision as of 09:10, 22 December 2013

Network forensics is the process of capturing information that moves over a network and trying to make sense of it in some kind of forensics capacity. A network forensics appliance is a device that automates this process.

There are both open source and proprietary network forensics systems available.

logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. [4]

log2Timeline a framework for automatic creation of a super timeline. The main purpose is to provide a single tool to parse various log files and artifacts found on suspect systems (and supporting systems, such as network equipment) and produce a timeline that can be analysed by forensic investigators/analysts. [5]

Hybrid Systems

Tips and Tricks

The time between two events triggered by an intruder (as seen in logfiles, for example) can be helpful. If it is very short, you can be pretty sure that the actions were performed by an automated script and not by a human user.